Privacy

• We store what you send through the contact form, so we can reply.
• We never store your IP address. Where we need to recognise repeat requests, we store a keyed hash of it instead.
• There are no advertising or analytics cookies, and nothing is sold or shared for marketing.
• We count page views and measure page speed with Vercel's cookieless analytics, which can't identify you.
• You can ask us to delete your messages at any time: info@cveminer.com.

Contact form submissions

When you send a message, we store your name, email address, company (if you give one), the topic, the vulnerability ID and analysis section (if any), your message, the time you sent it, your browser's user-agent string (cut to 300 characters) and a keyed hash of your IP address. We use these to reply to you and to spot abuse of the form. We never store the IP address itself.

Rate-limit counters

To stop any one network from exhausting the upstream APIs or flooding the contact form, CVEminer counts requests per network. Each counter is keyed by a hash of the IP address, made with a secret key so it can't be reversed by looking up known addresses, and it deletes itself automatically when its time window ends.

View counts

Each vulnerability record has a running total of how often it has been looked up, used to sort the database by popularity. The count isn't linked to you or your network.

Anonymous usage statistics

To see which pages are read and how fast they load, public pages use Vercel Web Analytics and Vercel Speed Insights. They set no cookies and store nothing on your device. With each page view they record the page address, the site that linked to it, your approximate location (country, region and city), and your browser, operating system and device type. Speed Insights adds loading-speed measurements and your connection type, for about half of all visits. Visitors are counted with a hash of the request that Vercel discards after 24 hours, so the statistics can't be tied to you. Anything you type into the search box is removed from the page address before it's sent, and the admin area isn't measured.

Staff session cookie

CVEminer's analysts sign in to an admin area, which sets one session cookie, __Host-cvm_admin. It's only set for staff, is not readable by page scripts and expires after 8 hours. Visitors never receive it.

Your theme choice

If you switch between light and dark mode, your choice is saved in your browser's local storage under cvm-theme. It stays on your device and is never sent to us.

• No advertising cookies, analytics cookies or tracking pixels.
• No selling, renting or sharing of your details for marketing.
• No passing your address to data sources. When you look up an ID, CVEminer's servers call OSV, GitHub, CVE.org, CISA and FIRST, not your browser, so those services don't see your IP address.

The site runs on Vercel, which receives every request (including your IP address) in order to serve it, under Vercel's privacy policy, and also holds the anonymous usage statistics described above. The database, which holds vulnerability records, contact messages and rate-limit counters, is hosted on MongoDB Atlas. Both may process data outside your country.

• Rate-limit counters: deleted automatically when their counting window ends, within about an hour of being created.
• Contact messages: kept while we deal with your request and for reference afterwards, until you or we delete them.
• The staff session cookie: 8 hours, or until the analyst signs out.
• The request hash used to count visitors: discarded by Vercel after 24 hours. The aggregated statistics stay in Vercel.

To see, correct or delete what we hold about you, email info@cveminer.com from the address you used, or tell us which address it was. We'll confirm once it's done. You don't have to give us any personal data to use CVEminer; only the contact form asks for it.

Questions about how records are built are answered on the About page.

If what we store changes, we'll update this page and the date at the top. The terms of use cover how you may use the site and its data.